Struct SecretKey 

pub struct SecretKey { /* private fields */ }

A validated age secret key protected by memory zeroization.

SecretKey wraps the raw key string inside Zeroizing, which guarantees that the memory is securely erased when the value is dropped. This prevents secrets from lingering in memory dumps or swap files.

Validation

The key is validated at construction time via new:

• It must be non‑empty.
• It must start with the string AGE-SECRET-KEY-1 (case‑sensitive).

Security properties

• Redacted display – Display and Debug print [REDACTED], never the actual key.
• Zeroization on drop – memory is overwritten with zeros when the SecretKey (or any clone) is dropped.
• Cloneable – cloning creates a new independent Zeroizing copy that is also zeroized separately.

Examples

use age_setup::SecretKey;

let sk = SecretKey::new("AGE-SECRET-KEY-1mytestkey".into())?;
println!("{}", sk);                       // prints: [REDACTED]
println!("{:?}", sk);                     // prints: SecretKey { ... [REDACTED] ... }
let raw = sk.expose_secret();             // careful: raw secret exposed

Implementations

impl SecretKey

pub fn new(raw: String) -> Result<Self>

Creates a new SecretKey after validating the raw string.

Validation checks

1. The key must not be empty.
2. The key must start with "AGE-SECRET-KEY-1".

Errors

Returns Error::Validation with a descriptive reason if any check fails.

Examples

let valid = SecretKey::new("AGE-SECRET-KEY-1abc".into()).unwrap();

let empty = SecretKey::new("".into());
assert!(empty.is_err());

let wrong_prefix = SecretKey::new("ssh-rsa ...".into());
assert!(wrong_prefix.is_err());

pub fn expose_secret(&self) -> &str

Exposes the raw secret key string.

⚠️ Security Warning – this method returns the actual secret material as a &str. Only use it when absolutely necessary (e.g., to pass the key to an age decryption function or to write it to a securely permissioned file). Avoid logging, printing, or storing the returned string in an unsecured location.

Examples

let sk = SecretKey::new("AGE-SECRET-KEY-1test".into()).unwrap();
let raw = sk.expose_secret();
assert_eq!(raw, "AGE-SECRET-KEY-1test");

Trait Implementations

impl Clone for SecretKey

fn clone(&self) -> SecretKey

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SecretKey

The Debug implementation records the secret value as [REDACTED] to prevent accidental leakage through debug output.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Display for SecretKey

The Display implementation always writes [REDACTED], never the actual key. Use expose_secret if you need the raw string.

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.